Vendor email scams can divert business payments to fraudulent accounts.
Such scams may begin with an email asking a business to send future payments to a different account. If the request is accepted, payments intended for a vendor may instead go to a scammer.
Criminals may use a hacked account, a spoofed vendor domain or another method to make a fraudulent payment request appear legitimate.
How Vendor Email Scams Work
In Business Email Compromise, or vendor invoice diversion, criminals may intercept or spoof communications to alter bank routing details over an extended period, according to the Internet Crime Complaint Center.
The scale of the problem nationally helps explain why these scams keep working. BEC complaints reached 24,768 nationwide in 2025, resulting in over $3.05 billion in reported losses, according to FBI data reported by DeepStrike. That same research notes that 74% of organizations that experienced payment fraud reported being targeted by attempted or actual Business Email Compromise.
Seen over a longer horizon, the numbers are even starker. Between 2013 and 2023, the Internet Crime Complaint Center recorded more than $55 billion in cumulative global exposed losses from Business Email Compromise across all 50 U.S. states and 186 countries. Total reported cybercrime losses in the United States hit $20.877 billion across more than 1 million complaints in 2025 alone, a 26% jump over the prior year, according to Barracuda Networks.
AI Tools Make the Emails Harder to Spot
Part of what's fueling the surge, according to research from SeedPod Cyber, is the growing use of artificial intelligence by fraudsters. The FBI's Internet Crime Complaint Center introduced AI-enabled cybercrime as its own reporting category in 2025, logging $893 million in losses tied directly to AI tools used to generate persuasive phishing text and spoof identities convincingly enough to fool even careful recipients.
Under Colorado Revised Statutes § 18-4-401, theft of money or property valued between $100,000 and $999,999 is classified as a Class 3 felony, carrying potential penalties of 4 to 12 years in prison and fines between $3,000 and $750,000, according to DeChant Law. Recovering money once it's been funneled through a fraudulent account, however, is notoriously difficult once funds are emptied out or moved overseas.
Verifying Payment Changes
The Internet Crime Complaint Center recommends verifying account-change requests through a secondary channel.
Vendor email scams are one form of payment fraud that can affect organizations in any community.
Businesses that receive unexpected payment-change requests should verify them through a separate channel. A similar $600K Texas vendor scam underscores how this style of fraud can affect businesses and municipalities alike.
